Preserve contract SemVer identity when the shared recovery suite changes

[rmcdaniel]

Problem

The shared release-recovery contract includes the conformance suite SHA-256 in its canonical content, and every consumer adapter pins the contract version, contract digest, and suite digest. The contract change guard now normalizes the suite digest away before comparing the previous and current contracts. A suite-only update can therefore change the contract bytes and digest while reusing the same contract version, allowing one version to identify multiple conformance suites and weakening cross-consumer qualification evidence.

Acceptance criteria

• Compare the full canonical previous and current contract content for version advancement, including suite.sha256.
• Add a focused regression proving that changing only the suite digest while retaining the same version fails closed, while the same change with a strictly advancing exact SemVer succeeds. Retain the existing equality, downgrade, prerelease, build-metadata, first-adoption, and unavailable-commit vectors.
• Propagate byte-identical corrected runner and contract files through every declared consumer target, with required CI pinning the same contract version, contract digest, and suite digest.
• Record aggregate public-target evidence only after every required target has landed the identical tuple.

Delete when

Delete when a suite-digest-only contract change cannot pass any declared consumer without a strictly advancing contract version, and aggregate evidence binds all required target commits to one identical version and digest tuple.

Required source targets

durable-workflow/.github@main
durable-workflow/cli@main
durable-workflow/sdk-php@main
durable-workflow/sdk-python@main
durable-workflow/sdk-rust@main
durable-workflow/server@main
durable-workflow/waterline@v2
durable-workflow/workflow@v2

[rmcdaniel]

Cross-repository landing evidence (generated from trusted implementation pull requests or authenticated protected-branch completion records):
Completion source: 7a574922b919e1ea846aaa757c65854c498dbd97

Target	Latest attempt	Bound provenance	Landing	Required qualification	State
durable-workflow/.github@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	7a574922b919	Passed: Control-plane source qualification (check run 30266037005); cited qualification: legacy generic qualification cited run 30266036947	complete
durable-workflow/cli@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	3afe7ace43d4	Passed: Target branch qualification (check run 30264734113); cited qualification: legacy generic qualification cited run 30264733950	complete
durable-workflow/sdk-php@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	961871df0fae	Passed: Target branch qualification (check run 30264463782); cited qualification: legacy generic qualification cited run 30264463859	complete
durable-workflow/sdk-python@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	23b4a170f364	Passed: Target branch qualification (check run 30265080552); cited qualification: legacy generic qualification cited run 30265080872	complete
durable-workflow/sdk-rust@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	9911d7783fcf	Passed: Target branch qualification (check run 30264475629); cited qualification: legacy generic qualification cited run 30264475748	complete
durable-workflow/server@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	f29e30032d53	Passed: PHPUnit feature suite (check run 30264911837); cited qualification: legacy generic qualification cited run 30264911801	complete
durable-workflow/waterline@v2	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	c2c8dbb9b2d0	Passed: Target branch qualification (check run 30265297272); cited qualification: legacy generic qualification cited run 30265297460	complete
durable-workflow/workflow@v2	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	8978f009c9f1	Passed: build (check run 30264175486); cited qualification: legacy generic qualification cited run 30264175413	complete

Every declared target landing and required repository qualification is complete.

[rmcdaniel]

Completed in 7a574922b919 on main.

Required public qualification passed: https://github.com/durable-workflow/.github/actions/runs/30266036947

Required cross-repository target qualification passed:

• cli:main at 3afe7ace43d4 (qualification)
• sdk-php:main at 961871df0fae (qualification)
• sdk-python:main at 23b4a170f364 (qualification)
• sdk-rust:main at 9911d7783fcf (qualification)
• server:main at f29e30032d53 (qualification)
• waterline:v2 at c2c8dbb9b2d0 (qualification)
• workflow:v2 at 8978f009c9f1 (qualification)